Privacy

• No ads, no tracking cookies, no Google. That’s why there is no cookie banner.
• We only keep what werk needs: mainly your first name, your email address and which sections you copied.
• Our database is in the EU. Some service providers (Cloudflare, Resend) are US companies – more on that below.
• We don’t sell data or pass it on for advertising.

werk.build runs on Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA): delivery of the pages, server functions (Cloudflare Workers) and database (Cloudflare D1, stored in the EU). When you open the site, Cloudflare processes technically necessary access data: IP address, date and time, requested address, referrer, browser and operating system, and the country derived from them.

The purpose is to deliver the site securely and fast, fend off attacks and find errors. Error and access logs of the server functions are deleted automatically after a few days. To prevent abuse we limit the number of requests per IP address; the IP address is only counted briefly in memory for this and not stored.

Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is running the site securely. We have a data processing agreement with Cloudflare (Art. 28 GDPR).

We serve all fonts, images and videos ourselves. Nothing is loaded from Google or other third parties.

To see how many visits the pages get and where they come from, we use Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and builds no profile of you. We only see aggregated numbers (e.g. page views, referring sites, countries, device types).

Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding and improving what we offer.

The full code of a section is shown once you enter your first name and email address. There is no account with a password.

What we store

• first name and email address, time of first and last use
• for every copy: section, version, time, device type (mobile or desktop) and the license key (see below)
• on your first copy: your country (derived by Cloudflare from your IP address; we don’t store the IP address itself) and, if your visit started on that very page, where you came from (e.g. campaign parameters or the referring website) and the landing page

Checking the address

We check the format, compare the domain with a public list of disposable email providers and look up via DNS whether the domain can receive email. Only the domain part of your address (e.g. “example.com”) is sent to Cloudflare’s DNS service for this. In addition we count, without any link to you, how often the form was opened and rejected.

What for

• to give you the code and recognise you on a new device,
• to let you know if a section you copied has an important bug or a security issue,
• to prevent abuse, check that our license is respected, and
• to understand which sections are used and how visitors find us.

License key

Every code you retrieve carries a license key made of the section’s number and a random code permanently assigned to you (e.g. “W01-7K2Q9F”). It appears in the code comment and, once you use the section, in your store’s public source code. Outsiders can’t link it to you – only we can. We use it to check that our license is respected, for instance by searching publicly accessible pages – also through source-code search services – for license keys and storing what we find (address, key, time, an excerpt of the page). Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our rights in the sections.

Without newsletter consent we only email you for the second reason – bugs and security issues – never about new sections or offers.

Legal basis for providing the code is Art. 6(1)(b) GDPR (the usage agreement under our Terms). For bug notices, abuse prevention and statistics it is Art. 6(1)(f) GDPR; our legitimate interest is a secure, working and evolving service. Without a first name and email address we can’t give you the code.

So that no programs pull code en masse or abuse forms, we use Cloudflare Turnstile in the email dialog and in the newsletter sign-up in the footer. Turnstile only loads when you use one of them. Your IP address and technical characteristics of your browser and device are sent to Cloudflare and evaluated to tell people from bots. Usually you won’t notice.

Once you pass, we set the cookie werk_pass. It holds your email address, an expiry date and a signature, can’t be read by scripts (HttpOnly), is only sent to our server functions and lasts 180 days, so you aren’t checked again on this device. “Forget this device” in the profile menu deletes it.

Legal basis is Art. 6(1)(f) GDPR (preventing abuse). Reading and storing information on your device is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG).

So that werk recognises you and remembers your settings, we keep a few things in your browser’s local storage. This data stays on your device; only first name and email are sent along when you copy.

You only get the newsletter if you explicitly sign up (in the footer, the profile menu or with its own checkbox in the email dialog). After signing up we send a confirmation email; you are only subscribed once you click the link in it (double opt-in). We send at most one confirmation email every ten minutes.

We store your email address, your first name (if known), where you signed up, and the time of sign-up, confirmation and, if applicable, unsubscription. Content: new sections and werk news, once or twice a month.

To send it, we add you as a contact at Resend (email address, first name, unsubscribe status and a random key for your unsubscribe and vote links). We don’t measure opens. Links in the newsletter go through werk.build so we can count how often a link was clicked – without any link to you and without your IP address. If you vote in the newsletter (“What should we build next?”), we store your choice only with an irreversible hash of your key (for links without a key: of your IP address), so everyone votes once.

Legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it anytime: via the unsubscribe link in every email, in the profile menu or by writing to us. After you unsubscribe we keep the address and the dates to be able to prove that consent was given (Art. 6(1)(c) and (f) GDPR), for at most three years.

Through the contact form we process: topic, and where given section, theme and store link, your message, first name, email address, device type and up to three screenshots. Screenshots are shrunk in your browser; metadata such as location is removed. Please don’t show other people’s personal data in screenshots, such as orders or customer data from your store.

The request is stored in our database and sent by email (via Resend, see below) to our inbox info@dta-media.de. The same applies if you email us directly.

Legal basis is Art. 6(1)(b) GDPR where your request concerns using werk or a contract, otherwise Art. 6(1)(f) GDPR (answering your request).

What you write on the “Request a section” note is stored with the time and, if you are known on this device, your email address, so we can follow up. We receive the request by email. Legal basis is Art. 6(1)(f) GDPR (developing what we offer).

Emails from werk (confirmation, newsletter, notices, forwarding requests to us) are sent via Resend (Plus Five Five, Inc., USA). Resend processes the recipient address, content and delivery status and, for the newsletter, the subscriber list on our behalf (Art. 28 GDPR). If someone unsubscribes via Resend, Resend reports it back to us.

Our inbox info@dta-media.de is hosted by SiteGround (SiteGround Spain S.L., Spain) as our processor.

The sections you copy send no data to us. They only carry your license key, which reveals nothing about your store’s visitors. Until you replace them, they load demo images and fonts from Shopify’s own content delivery network (cdn.shopify.com). You are responsible for your store and your visitors’ data; you don’t need a data processing agreement with us for it.

Our demo store and linked sites such as dta-media.de have their own privacy notices. The demo store runs on Shopify; what is processed there is described in its privacy policy. When you follow a link, that site’s policy applies.

Your data is seen only by the two of us (Timo Kardatzki and Alexander Holzleitner) and the processors named above: Cloudflare (hosting, database, bot protection, analytics), Resend (sending email) and SiteGround (inbox).

Cloudflare and Resend are US companies; access from the USA cannot be ruled out. Transfers rely on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it, and additionally on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

• First name, email and copies: as long as you use werk; deleted right away on request, at the latest three years after your last copy.
• Newsletter: until you unsubscribe, then only the proof of consent, for at most three years.
• Contact requests and screenshots: twelve months after the request is closed, unless statutory retention requires longer.
• Section requests: until we have built or dropped them, at most three years.
• Access logs: a few days.
• Browser storage and cookie: see above.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent anytime with effect for the future (Art. 7(3)). An email to info@dta-media.de is enough.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f)), you can object anytime on grounds relating to your particular situation. You can object to emails for marketing purposes anytime without giving reasons.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Ours is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

There is no automated decision-making within the meaning of Art. 22 GDPR. The automatic check of your email address only decides whether the code is shown.

When werk or the services we use change, we update this policy. The version published here applies; the date is at the top.